A smart speaker with a virtual assistant processes voice commands, manages smart home devices, accesses cloud services and often has an always-listening microphone. The cybersecurity surface is extensive: voice data privacy, authentication of connected devices, cloud API security, OTA firmware updates. Annex III point 16 classifies general-purpose virtual assistants as Class I. If harmonised standards are not fully applied, conformity assessment by a notified body is required under Article 32.2. CRACheck generates 8 PDF documents per Annex VII. 15-25 minutes. €149. Browser-side.
€149 one-time · 8-document ZIP · 15-25 minutes · Browser-side
A virtual assistant listens. CRA requires you to document how you secure what it hears.
A virtual assistant listens. CRA requires you to document how you secure what it hears.
If your smart speaker integrates Alexa or Google Assistant, the platform vendor provides the VA service. But you are the manufacturer of the product with digital elements under Art. 3(13). Your hardware, your firmware, your WiFi module, your microphone, your OTA updates — all are your responsibility. The platform vendor's compliance does not cover your product.
Annex I Part I point 1(c) requires protection of data confidentiality. Even if voice processing happens in the platform vendor's cloud, your product transmits the voice data over WiFi. The security of the transmission — encryption, authentication, channel integrity — is your responsibility. Document it.
Art. 13.8 requires you to declare a support period. If the VA platform is discontinued within your support period, the product loses core functionality. Document the dependency on the platform and what happens to the product if the VA service is discontinued. Annex II requires informing users about the support period.
Smart speakers with virtual assistants combine audio hardware, microphone privacy, cloud processing and smart home control. CRACheck documents all dimensions.
Determines product category per Annex III. Defines conformity assessment route under Art. 32.
Complete technical documentation structured per Art. 31 and Annex VII. All 8 mandatory sections.
Cybersecurity risk assessment per Art. 13.2 and Art. 13.3. Mapped against Annex I Part I requirements.
Information and instructions per Annex II. Security properties, support period, vulnerability reporting.
EU declaration of conformity per Art. 28 and Annex V.
Coordinated Vulnerability Disclosure policy per Annex I Part II.
Pre-structured for 24h early warning, 72h notification, 14-day final report under Art. 14.
Key dates: Art. 14 from 11 Sep 2026, full enforcement 11 Dec 2027, support period per Art. 13.8.
Mira antes de comprar — Descargar dossier de muestra (PDF, empresa ficticia) — Estructura real, artículos reales, formato real. Datos ficticios.
Generated in your browser. No product data is transmitted to any server.